The incident

On 26 October 2026 the University of New Mexico Health Sciences Center detected a cybersecurity incident, diverted ambulances for about two hours, from 12.30pm to 2.30pm, and cancelled appointments that day. UNM Hospital is New Mexico's only Level I trauma centre. Services resumed on 27 October.

The unusual twist

A new group calling itself BYOD claimed responsibility, alleging 36,000 systems were compromised and data taken. A day later it apologised, said it had not realised some machines supported real-time patient care, and offered free decryption keys for hospital-sector devices only, while saying it would keep any data it claims to hold.

What is not confirmed

UNM has not confirmed any data theft, and the group also offered up to $2,500 per affected patient on proof, an offer whose legitimacy is unproven. UNM warned on 29 October that scammers may exploit public concern with false payment or compensation offers. The BYOD claims are reported here as claims, not fact.

Sources: Gizmodo | HIPAA Journal